Security Policy

Encryption

• All traffic is served over TLS (HTTPS), with HSTS enabled.
• Data at rest in our database and object storage is encrypted by the platform.
• Private message bodies are stored encrypted with a server-held key so that message content is not readable from raw table data. Directors, moderators and administrators cannot browse your DMs.
• Third-party credentials (for example calendar connections) are stored as ciphertext, never as plain text.

Access control

• Every table is protected by row-level security: you can only read rows you own or that are explicitly public.
• Private auditions, unsaved replays and unpublished profiles are not reachable by other members, even with a direct link.
• Administrative actions such as verification decisions are role-gated and written to an audit log.
• Profile and media changes are recorded — what changed, when, and by which user.

Abuse resistance

• Per-account rate limits on messaging, applications, uploads, AI generation and checkout — see the Rate Limits & Fair Use page.
• Automated spam scoring on stage chat with a moderator review queue.
• Escrow on bookings and shop orders so funds are only released on confirmation.
• Security headers (content security policy, frame denial, strict referrer and permissions policy) on served pages.

Reporting a vulnerability

Email security@scriptu.org with steps to reproduce. We aim to acknowledge within 3 business days. Please do not access other members' data, degrade the service or run destructive tests; good-faith research reported privately will not be pursued by us.

Machine-readable contact details are published at /.well-known/security.txt.

Honest limits

We invest heavily in security, but no online platform can promise it is impossible to breach — any service that claims otherwise is not being straight with you. We commit instead to layered defences, least-privilege access, and notifying affected users and regulators without undue delay if an incident ever occurs.